Indicators are what attackers leave behind. Stolen credentials are what they arrive with.
2 IOCs
NadMesh Botnet Targets AI and MCP Servers With 20+ Remote Code Execution Vectors
Excerpt
Discovered in early July 2026, NadMesh identifies itself in code as “n4d mesh controller” and operates as a long‑lived, iteratively developed botnet rather than a one‑off worm outbreak. It is written in Go and integrates Scanning, exploitation, credential theft, and AI/MCP service intelligence collection into a single mesh‑style infrastructure centered on attacker‑controlled VPS nodes. The name NadMesh comes from the controller component, which coordinates large numbers of…
Read the original report →Diamond Model
Adversary
Infrastructure(2)
Capability
Victim
Indicators of Compromise
Open the mindmap →2 indicators
| Type | Indicator | Confidence | Score | First Seen |
|---|---|---|---|---|
| IP | 209.99.186.235 | High | Score 66/100 | First seen |
| Domain | cdnorigin.net | High | Score 70/100 | First seen |
IOC Relationship Graph
Building graph…